You all know this. I (in theory) know this. However, just to remind everyone (and apparently myself)...

When debugging anything related to WCF, there are a set of problems that are IMPOSSIBLE to discover without looking at the service trace logs. In particular (this is the one that bit me) for very good reasons, nothing security related gets as far as application code. You pretty much get "something bad happened".

Anyway, after beating my head against the keyboard for a good solid day, I remembered this little maxim, and checked the logs. There was the problem, plain as day. Doh! Turned out that I'd changed the namespace of a particular class, and failed to propagate that change to my .svc file. There is absolutely no indication that this was the problem at the app level, but on looking at the logs, it's right there.